Shamoon malware cripples Windows PCs to cover tracks

A new Trojan horse tries to covers its tracks by crippling the victim's computer after stealing data, a security researcher said today.

Dubbed "Shamoon" by most antivirus companies, the malware has been used in targeted attacks aimed at specific individuals or firms, including at least one in the energy sector.

According to Israeli security company Seculert, Shamoon relies on a one-two punch, first taking control of a system connected to the Internet before spreading to other PCs on an organization's network.

The second stage -- which kicks off after the malware has done its dirty work -- overwrites files and the Master Boot Record (MBR) of the machine. The latter makes the PC unbootable.

"They are looking for ways to cover their tracks," said Aviv Raff, CTO and co-founder of Seculert, in a Friday interview.

Seculert and other security companies, including Moscow-based Kaspersky Lab and U.S. antivirus vendor Symantec, have not yet figured out kind of data Shamoon is looking for, then stealing. They assume that because the malware uses a second infected system to communicate with a hacker-controlled command-and-control (C&C) server, Shamoon is copying files from pillaged PCs and sending that information to its masters.

Malware rarely destroys files or wipes the MBR. Most threats try to work quietly to avoid detection as long as possible. Crippling a computer only brings unwanted attention.

"Threats with such destructive payloads are unusual and are not typical of targeted attacks," said Symantec on a Thursday post to its security response team's blog.

Because a list of overwritten files is transmitted to the C&C server, Raff speculated that Shamoon's makers wanted to "know what and how much got wiped."

The destructiveness of Shamoon -- its distinguishing trait, really -- brought up memories of an attack against Iranian computers earlier this year that also wiped hard drives.

Community Comments

Whether you use an American company or an Australian company is irrelevant. The Patriot act guarantees access to your data if the hosting company has even a single point of presence on US soil -- and that is regardless of whether or not your company's ...

Copyright 2015 IDG Communications. ABN 14 001 592 650. All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.